Encryption & discovery

Encrypted delivery

The reference construction uses ephemeral Diffie–Hellman on Grumpkin and Poseidon2-derived field masks. Incoming and outgoing viewing material support separate recovery paths. A trial-decryption tag helps a scanner identify relevant payloads.

Encryption correctness belongs inside the proof: an intermediary must not be able to produce an accepted output that the recipient cannot recover, redirect it to a different key, or encrypt a different value.

Public and private fields

Ordinary shielded-transfer payloads carry encrypted ownership and value data. Deposit information originates in a public transaction. Swaps have execution-dependent outputs and can expose asset and amount information; they do not provide identical confidentiality to an internal transfer.

Implementation requirements

• Use cryptographically secure randomness and unique ephemeral secrets.
• Constrain curve points, field encodings, and payload lengths.
• Domain-separate encryption, commitments, and key derivation.
• Test malformed ciphertext, incorrect tags, recovery, and sender receipts.
• Commission independent cryptographic review before deploying a custom construction.